A fast rule-matching algorithm in network intrusion detection
YU Hai-feng · Journal of Naval University of Engineering · 2004
Based on the analysis of network intrusion detection systems, this paper points out the shortage of existing rule-matching algorithms, and then puts forward a new fast rule-matching algorithm. This algorithm is fast and effective because it uses the fuzzy matching method, and reduces the ranges of intrusion classes. In addition, such algorithm can be used to identify the suspicious intrusion behavior according to the different threshold that is set up based on various security levels.